Claude in Our Dev Lifecycle

From writing code to orchestrating AI — how the team should set up Claude, where the leverage is, and the guardrails that keep us safe.

Cheat Sheet · Setup · Workflows · Security

The Mindset Shift

The biggest unlock isn't faster typing. It's that you stop being the bottleneck.

Old loop — you are the developer

  • Read ticket → write code → test → PR
  • One task at a time, in your head
  • Knowledge lives in tribal memory
  • You are the bottleneck

New loop — you are the PM/Architect

  • Describe intent + constraints → review → ship
  • 2–4 things in flight (foreground + background + scheduled)
  • Knowledge in CLAUDE.md, MCP descriptions, memory
  • You operate a junior team that never sleeps

Rule of thumb: if you're typing the same thing twice, it belongs in CLAUDE.md, a slash command, an MCP description, or a hook — not in your head.

Three Surfaces — Pick the Right One

>_

Terminal (CLI)

Lowest friction. Best for shell-heavy work, git ops, anything where Claude needs to see command output directly. Sessions live under ~/.claude/projects/.

💻

VS Code

Best for code-heavy tasks with side-by-side diffs. Picks up the same settings + project allowlist. Use /ide from CLI to attach a terminal session.

🏠

Desktop App (WHERE I LIVE)

Real session management, mobile/web continuity, push notifications for background runs. The PM-of-AI surface.

Why I migrated to Desktop: named sessions per project, parallel chats, mobile pickup from claude.ai, and background agents surface as proper notifications — not lines scrolling off a terminal.

Workflow

Git Worktrees + Parallel Conversations

One repo. Three checkouts. Three Claude sessions. Zero merge chaos.

The Pattern

  • Each git worktree add creates a separate working directory pointed at a different branch
  • Each worktree gets its own .claude/ — isolated session history, allowlists, and context
  • Run a separate Claude per worktree (CLI windows, or one Desktop session per path)
  • No file-lock fights. No mid-conversation branch switches. No cross-pollination of plans.
  • DevAgent uses this pattern internally — each ticket gets a sandboxed worktree
# spin up three parallel workspaces on TaskManager
git worktree add ../TM-routing      feature.routing
git worktree add ../TM-merge-fix    bugfix.merge-accounts
git worktree add ../TM-llm-tuning   feature.llm-tuning

# open one Claude per worktree
cd ../TM-routing && claude   # window 1
cd ../TM-merge-fix && claude # window 2

# cleanup
git worktree remove ../TM-routing
git worktree prune

Why It Works

  • Branch isolation. Each session sees only its own branch + WIP. No "wait, why did Claude touch that file?"
  • Context isolation. Each Desktop session owns one task. No bleed.
  • True parallelism. Long refactor in one window, hotfix in another, PR review in a third.
  • Safe experiments. Throwaway worktrees you can remove with no trace on main.
  • Isolated agents. Pair with the isolation: "worktree" sub-agent flag for fully-sandboxed AI work.

Pairs With

Prompt: 4 parallel Explore agents Prompt: New worktree + agent Desktop: session per path
Mental model: a worktree is a thread. Each Claude session owns one thread. You are the orchestrator deciding what each thread is doing.

Configuration — Two Files That Matter

~/.claude/settings.json

Personal, machine-wide. Yours alone.

  • Default model + effort level
  • Personal MCP servers (DTLR-Database-Tools, chrome-devtools, drawio, shopify-dev-mcp)
  • Global permission allowlists you trust everywhere
  • Env vars + hook scripts
// my settings.json
{
  "effortLevel": "high",
  "mcpServers": {
    "DTLR-Database-Tools": { ... },
    "chrome-devtools":    { ... }
  }
}

<repo>/.claude/settings.local.json

Project, gitignored. Yours per repo.

  • permissions.allow — pre-approved Bash patterns to kill prompt fatigue
  • Project-specific overrides on top of personal settings
  • Run /fewer-permission-prompts to auto-build the list from your transcripts

<repo>/.claude/settings.json

Project, committed. Team defaults.

  • Pinned model, hooks, MCP servers everyone needs
  • Travels with the repo — new clones get the right setup

CLAUDE.md — Three Layers

The single highest-leverage file you can write. Auto-loaded when Claude enters a directory.

Global

~/.claude/CLAUDE.md

Loads every session. Who you are, hard rules, pointers to org docs. Keep it short.

Repo

<repo>/CLAUDE.md

Committed. What this service is/isn't, architecture in 5 bullets, gotchas, run/test/deploy. Pointers, not prose.

Subdir

<repo>/<area>/CLAUDE.md

Auto-loads when working in that subtree. Domain-specific rules that don't belong at the top.

Reference example: DTLR-MCP/Toolbox/CLAUDE.md — documents the schema brain (data sources, security posture, gotchas like location_code vs location_id, ShopperTrak/RetailNext naming history). When the next dev (or AI) extends it, they don't have to ask.

Write the why, not the what. Code shows what; the file explains incidents, constraints, and trade-offs you can't infer. Update it when Claude gets something wrong.

design.md & Effort Levels

design.md — Plan Before You Build

  • You sketch goal + constraints + rough approach (5–10 bullets)
  • Ask Claude to poke holes — edge cases, security, ops — no code yet
  • Iterate the doc until you both agree
  • Then implement, with the doc loaded as context

The expensive failure mode is correct execution of the wrong design. A 10-minute design pass prevents most of that.

/effort low | medium | high

lowRenames, formatting, quick edits. Fast and cheap.
mediumDefault. Bug fixes, small features.
highMulti-file, architectural, security-sensitive. Mine is pinned here.
/fastOpus 4.6 with faster output for known-simple work.

Slow-and-thorough beats fast-and-sloppy on leverage work. Flip down to medium for cleanup tickets.

Slash Commands Worth Knowing

CommandWhat it does
/initScaffold a CLAUDE.md for the current repo
/effort low|medium|highSet thoroughness for the session
/fastToggle fast-mode on Opus 4.6
/clearDrop conversation context (use when switching topics)
/compactManually compact context (auto happens near the limit)
/reviewReview a PR (uses gh under the hood)
/security-reviewSecurity pass on pending changes
/simplifyHave Claude review its own changes for reuse/quality/duplication
/fewer-permission-promptsAudit transcripts and propose Bash allowlist additions
/loop <interval> <prompt>Recurring local agent (or self-paced if no interval)
/scheduleManage cron-scheduled remote agents
/helpList everything

Build your own: drop markdown files in ~/.claude/commands/ (personal) or <repo>/.claude/commands/ (team). Treat them like saved prompts.

Our MCP Stack

MCP (Model Context Protocol) is how Claude talks to anything that isn't a file.

📊

DTLR-Database-Tools

Internal MCP at 10.67.0.67:8080. ~22 tools across 6 sources. Read-only.

🌐

chrome-devtools

Browser automation, screenshots, console + network inspection, Lighthouse.

📋

drawio

Render Mermaid / CSV / XML diagrams inline in conversation.

🛒

shopify-dev-mcp

Official Shopify docs + GraphQL/theme validation.

📚

Microsoft Learn

Search/fetch official MS docs — useful for Foundry, Azure, Graph.

+

Add Your Own

Personal → ~/.claude/settings.json. Team-wide → repo's .claude/settings.json.

Why MCP matters: any LLM-powered process at DTLR — TaskManager, DevAgent, DTLR-IQ, your terminal — consults the same tool descriptions. Update once, every consumer gets smarter.
Internal MCP

DTLR-Database-Tools

The Schema Brain

  • Built on Google GenAI Toolbox — tool descriptions are the routing intelligence
  • 4 tools per source + global get-schema-summary as the table of contents
  • All access is READ-ONLY via Global_AI_Reader
  • Schema gotchas (linked-server quirks, location_code vs location_id, ShopperTrak vs RetailNext) live in the descriptions — not in each app
  • Add a new table = update tools.yaml in DTLR-MCP/Toolbox once

Data Sources

delorean — Reporting hellcat — Legacy/Critical mustang — DEV/QA sql-azure — Middleware planetscale-company — DREAM planetscale-ecommerce — E-com
Live demo: Top 5 SKUs (no SQL) Live demo: Anomaly hunt
22
Tools
6
Sources
0
Writes

Use it from terminal Claude: "What were our top 5 selling SKUs last week?" → tool routes to delorean-execute-query on sales_transactions_daily → you get the answer with no SQL written.

Compounding

Recursive Self-Documentation

Documentation that improves itself. Every session leaves the corpus smarter than it found it.

1
Detect Gap

Agent hits an undocumented table or column while answering

2
Introspect

Sample rows + foreign keys + naming patterns + query history → infer purpose

3
Patch tools.yaml + CLAUDE.md

Column hints, join keys, gotchas, "BEST FOR" guidance

4
Open Doc-PR

Tagged schema-doc:auto. SME reviews + merges.

5
Loop

Next session inherits the upgrade. Routes faster, queries better, finds the next gap.

Where It Already Runs

  • DTLR-MCP/Toolbox/tools.yaml — tool descriptions are the routing brain
  • DTLR-MCP/Toolbox/CLAUDE.md — tier-1/2/3 priority + how to add a table
  • Auto-generated repo CLAUDE.mds via /init
  • TaskManager + DTLR-IQ post-merge doc workflows (Confluence sync via NET-1457)

Live Demo Prompts

Document a Tier-3 table Refresh repo CLAUDE.md Generate architecture map Find documentation gaps
The compounding effect: the more we use the system → more docs generated → better context for the next agent → better answers. Self-improving infrastructure with no humans in the inner loop.
Browser MCP

Chrome DevTools MCP

What Claude Can Do With a Browser

  • Open pages, click, fill forms, navigate
  • Take screenshots (full page or element)
  • Read console messages + network requests
  • Run Lighthouse audits
  • Performance traces and memory snapshots

How I Use It

  • "Open the dashboard, screenshot the broken card, fix the CSS." — Claude sees the rendered output
  • Frontend regression checks — navigate the golden path, screenshot each step
  • "What's in the network tab when I click X" — debug without copy-pasting HAR files
  • Validate UI changes before committing — the AI can verify its own work visually
Closes the loop on UI work: AI generates code → AI takes screenshot → AI verifies the visual matches intent. You review the screenshot, not the CSS.
Agentic AI

DevAgent — the Jr Developer Bot

Jira Ticket
Sandbox Clone
Claude API
Tests
Draft PR
Human Review

How It Runs

  • Watches Jira for AI-assignable tickets
  • Clones into an isolated Azure Container App
  • Calls Claude (Anthropic API) for plan + implementation
  • Runs tests, opens a draft PR with reviewers attached
  • GitHub webhook + Teams Adaptive Card surface progress
  • Humans approve before merge — nothing auto-merges

Safety Controls

  • X-Api-Key middleware on all endpoints
  • GitHub App webhook secret + branch protection
  • File-change limits + CODEOWNERS gates
  • Container App secrets (secretref:) — nothing in committed config
  • Sandboxed scope — only repos the GitHub App is installed on
  • Cancel endpoint + live status card so we can pull the plug
Decision Intelligence

TaskManager LLM — A Pluggable Layer

Where It Started

  • Services/LLM/AzureOpenAIService.cs — thin wrapper around Foundry's GPT (gpt-5.4)
  • Token usage logged to Hangfire console — prompt overflow visible in real time
  • Built originally for the Analyst Reporting flow — KPI strips, anomaly bullets, weekly outlook reports

Discipline Baked In

  • Anti-single-cause rule: weather/holidays are contributors, not whole explanations
  • Scope-aware filtering (chain ≥90, region ≥85)
  • Refuse to ship LLM fallback stubs — better to fail loud than silently lie

Where It's Going

  • The same IAzureOpenAIService plugs into any background job
  • Order routing — smarter fulfillment decisions
  • Exception handling — auto-triage and resolution
  • Monitoring + alerting — proactive issue detection
  • Supply ordering, dropship triage, returns analysis
We don't write a new LLM client per process. One service, many prompts.

More Agents in Flight

🔎

ResearchAgent

Vendor-style competitor sweep — price, promo, shipping, stock. Built on MAF / Semantic Kernel on .NET, sharing runtime with DTLR-IQ & DevAgent. Sister-chains framed as alignment partners, not threats.

💭

DTLR-IQ

Teams-integrated RAG bot. Ingests Confluence, policies, handbooks. Vector search → cited answers. Embedded in DREAM portal too.

🧠

DTLR-MCP / Toolbox

Shared schema brain (slide 9). Every agent gets the same routing intelligence. tools.yaml + CLAUDE.md.

🤝

Dtlr.Agents.Abstractions

Cross-agent contract: IAgent<TRequest,TResult>. Future agents (forecasting, vendor-comms) plug in through the same shape.

Same .NET runtime. Same Foundry config. Same Teams plumbing. Layer once, reuse everywhere.

MS Foundry — Where Our Models Live

Foundry Setup

  • Models deployed via Microsoft Azure AI Foundry
  • Current chat deployment: gpt-5.4
  • Wired into TaskManager + ResearchAgent + DTLR-IQ
  • Endpoint + key in IConfigurationnever hard-coded
  • Local: user-secrets. Prod: Container App secrets / Azure Key Vault

Why Foundry

  • Data stays in our Azure tenant
  • Billing + observability in the same portal as our infra
  • Content-filtering policies enforced centrally
  • Model swaps are a config change — not a code change
Foundry handles GPT. Anthropic API handles Claude (DevAgent's coding phase). Right tool for the job.

Security — Non-Negotiables

OK to share with AI

  • Code in our repos (we're on the enterprise plan)
  • Schemas, table names, query patterns
  • Internal docs already in DTLR-IQ
  • Test/synthetic data

NOT OK to share

  • Customer PII (names, emails, phones, addresses)
  • Production secrets, API keys, connection strings
  • Vendor-NDA material without a DPA
  • Raw card numbers / anything PCI-scoped
  • .env in .gitignore always. Commit .env.example with keys, never values.
  • Container App secrets via secretref: env-var refs — rotate without a commit.
  • Read-only by default. The internal MCP enforces it at the credential layer.
  • Sandboxed agents. DevAgent runs isolated, scoped to specific repos via the GitHub App install.
  • Draft PRs only. Humans review and merge. AI never auto-merges.
  • /security-review before human review — not instead of it.
  • RAG Orchestration — Pass the Right Context

    1
    Intent Route

    Which corpus? HR? Procedure? System docs? Live analytics?

    2
    Retriever

    Vector search the picked corpus → top-k chunks

    3
    LLM Compose

    System prompt + chunks + user question → cited answer

    4
    MCP Tools

    If the question needs live data — call DTLR-Database-Tools directly

    Principles

    • Don't dump the whole corpus. Retrieve, then compose.
    • Different corpora for different intents. A policy question and a sales question pull from different vector stores.
    • MCP for live data, RAG for documents. Don't try to RAG over a constantly-changing transactional database — query it.
    • Always cite. Answers without citations are guesses.

    Orchestration — Have Context Ready

    Three controls + one operating model.

    /loop

    "Every 5 min, check the deploy and ping me on failure." Active monitoring while you're at the keyboard.

    /schedule

    Cron-style remote triggers. Wakes whether you're online or not. "Every weekday 7am: PR summary to Teams."

    📱

    RemoteTrigger

    Desktop app fires agents from your phone. Push notifications when background work finishes.

    My weekly cadence: Mon 7am scheduled agent → PR summary. Mon 8am open Desktop → plan the week. Mon–Fri foreground sessions + /loop on the deploy + DevAgent on tagged tickets. Fri 5pm scheduled agent → weekly wrap. Zero touches on weekends.

    Context Management — The Make-or-Break Skill

    LayerLivesUse For
    Conversation contextUntil /clear or compactionThe current task
    Plans / tasksCurrent conversationStep-by-step within one task
    MemoryAcross conversationsWhat future-you needs to know
  • Start fresh for unrelated work. /clear is free; cross-context noise hurts both jobs.
  • Compact, don't continue forever. Long sessions degrade — wrap up, summarize, start clean.
  • Sub-agents for searches. Big greps belong in a sub-agent so your main context stays clean.
  • Pre-load context for tomorrow. End of day: "summarize what we did and what's left." Save it. Paste it back tomorrow.
  • Use Memory. User prefs, feedback, project facts, references — auto-loaded next session.
  • Plans vs Tasks vs Memory. Plans for design, tasks for current-conversation steps, memory for next-time.
  • Vision

    The Hands-Off Self-Healing Loop

    Production breaks. By the time you read the alert, the PR is open with a screenshot. No human in the inner loop.

    Datadog Alert
    Auto-Ticket
    Triage Agent
    Repro + Screenshot
    DevAgent Fix
    Draft PR
    Deploy
    Verify + Close

    Click any step to see how it actually wires up — what's already in place vs. what's next.

    What We Already Have

    • Datadog — logs, metrics, error tracking on TaskManager + APIs
    • DevAgent — Jira → sandboxed Claude → draft PR → Teams card
    • chrome-devtools MCP — browser repro + screenshots attached to PRs
    • DTLR-Database-Tools MCP — agent pulls live data context to validate the fix
    • GitHub App webhook — reactive PR/issue plumbing

    What Closes the Loop Next

    • Datadog → Triage Agent webhook — dedupes alerts into tickets
    • Stack-trace + log-window ingestion — full context attached, not just a one-liner
    • Auto-repro harness — structured "reproduce in dev" scaffold the agent fills in
    • Post-deploy verifier — Datadog query confirms error rate dropped → ticket auto-closes
    • Confidence gates — high-confidence fixes auto-merge to dev; main is always human-gated
    Endgame: production self-heals while we sleep. Humans review the merge queue at 9am like a triage nurse — not write the fixes themselves.

    10 Rules for Devs New to AI

    1
    You're not paid to type code.You ship outcomes. Code is one output.
    2
    Read more than you write.Reviewing AI output thoughtfully is the #1 skill.
    3
    Trust but verify."It compiles" ≠ "it works." Run the feature.
    4
    Be specific.Vague prompts get vague code. Name the file, the method, the constraint.
    5
    Update the docs as you go.Every AI mistake → CLAUDE.md note. Corpus compounds.
    6
    Own the architecture.AI is great at local optimization, mediocre at global design.
    7
    Don't lose your fundamentals.Pair with the AI; don't outsource to it.
    8
    Bias toward leverage.Same thing twice? Build the lever — CLAUDE.md, slash command, MCP tool, hook.
    9
    Security is not optional.The faster you ship, the easier it is to ship a leak.
    10
    Operate as a PM.Write tickets. Set acceptance criteria. Define done. AI is your team; you're accountable.

    Small But Mighty

    AI is the lever. The team that masters orchestration wins. We are already ahead — let's stay there.

    Monday Homework: Pick one repo. Write or improve its CLAUDE.md. Set your effortLevel. Install one MCP. That's it.
    View Full AI Strategy →